package com.jt.resource.config;

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.oauth2.config.annotation.web.configuration.EnableResourceServer;
import org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfigurerAdapter;

@Configuration
@EnableResourceServer  //开启资源访问控制
@EnableGlobalMethodSecurity(prePostEnabled = true)//开启方法上的权限检查,与@PreAuthorize注解配合使用
public class ResourceConfig extends ResourceServerConfigurerAdapter {

    @Override
    public void configure(HttpSecurity http) throws Exception {
        //1.关闭跨域攻击
        http.csrf().disable();
        //2.定义资源访问规则
        http.authorizeRequests()
                //配置需要认证以后才可以访问的资源
                .antMatchers("/resource/*").authenticated()
                //其他资源则可以匿名访问
                .anyRequest().permitAll();
    }
}
